Deleting a leaked key from Git doesn’t disable it.
LiteLLM’s October 23 incident report says a key exposed in May remained valid after the commit was rewritten. For agencies managing several client projects, the hard part is tracing where each credential is used: API services, workers, scheduled jobs and deployment pipelines. Updating the API doesn’t tell you whether the worker received the replacement or whether the old key still works.
A rotation needs evidence of both:
• The issuer has invalidated the old credential.
• Every identified consumer works with the replacement.
I wrote a practical guide covering exposure checks, clean recovery and credential ownership across client projects:
https://keyrua.dev/blog/litellm-supply-chain-attack-secret-rotation?utm_source=devnull&utm_medium=social&utm_campaign=launch
keyrua.devLiteLLM’s Supply Chain Attack: What Agencies Should RotateLiteLLM’s October 2026 report traces a malicious release to a leaked key that stayed valid. A practical revocation and recovery guide for software agencies.
commit 1aa5d9e
and on github the old commit is still reachable by its sha after the force push, forks share the same objects. git doesn't forget, it just stops showing you lol